cloud computing security research paper

Information

• Author Services

Initiatives

You are accessing a machine-readable page. In order to be human-readable, please install an RSS reader.

All articles published by MDPI are made immediately available worldwide under an open access license. No special permission is required to reuse all or part of the article published by MDPI, including figures and tables. For articles published under an open access Creative Common CC BY license, any part of the article may be reused without permission provided that the original article is clearly cited. For more information, please refer to https://www.mdpi.com/openaccess .

Feature papers represent the most advanced research with significant potential for high impact in the field. A Feature Paper should be a substantial original Article that involves several techniques or approaches, provides an outlook for future research directions and describes possible research applications.

Feature papers are submitted upon individual invitation or recommendation by the scientific editors and must receive positive feedback from the reviewers.

Editor’s Choice articles are based on recommendations by the scientific editors of MDPI journals from around the world. Editors select a small number of articles recently published in the journal that they believe will be particularly interesting to readers, or important in the respective research area. The aim is to provide a snapshot of some of the most exciting work published in the various research areas of the journal.

Original Submission Date Received: .

• Active Journals
• Find a Journal
• Proceedings Series
• For Authors
• For Reviewers
• For Editors
• For Librarians
• For Publishers
• For Societies
• For Conference Organizers
• Open Access Policy
• Institutional Open Access Program
• Special Issues Guidelines
• Editorial Process
• Research and Publication Ethics
• Article Processing Charges
• Testimonials
• Preprints.org
• SciProfiles
• Encyclopedia

Article Menu

• Subscribe SciFeed
• Recommended Articles
• Google Scholar
• on Google Scholar
• Table of Contents

Find support for a specific problem in the support section of our website.

Please let us know what you think of our products and services.

Visit our dedicated information section to learn more about MDPI.

JSmol Viewer

Security and privacy in cloud computing: technical review.

1. Introduction

• Understanding of the cloud computing concept in relation to user privacy and security.
• Classification of cloud components, threats, and security implementations based on the STRIDE model.
• Providing security and privacy classifications based on attack mitigation and adaptiveness.
• Providing different approaches to what and how existing works in the literature have provided solutions to cloud computing security and privacy.

2. Background

2.1. cloud computing service delivery models.

• Cloud Infrastructure as a Service (IaaS): IaaS provides aggregated resources managed physically. Service delivery is in the form of storage or computational capability. The IaaS platform offers storage, provision processing and networks for consumers to run and deploy arbitrary software for applications and operating systems. The platform user might not have absolute control over the underlying infrastructure but control the deployed applications, operating system, and network components. The IaaS layer represents the pillar for which most cloud computing architectures have been built [ 41 ]. As a result of high advancement in technology, computational power, storage devices and high-end communication, the IaaS layer has become the most efficient platform on which the PaaS and SaaS rely.
• Cloud Platform as a Service (PaaS): PaaS provides platforms and programming environments for cloud infrastructure services. Examples of PaaS includes Google App Engine, Dipper, Yahoo and Salesforce. PaaS also refers to the application developed by a programming language and hosted by a CSP in the cloud [ 41 ]. PaaS is the service abstraction of the cloud that deals with the creation and modification of applications that already exist. The advantage of PaaS is provisioning platform environments with full operational and developmental features for application deployment. Furthermore, PaaS provides a trusted environment for users’ secure storage and processing of confidential information, leveraged by the cryptographic co-processors [ 42 ] that protect against unauthorised access. The central design and goal of the PaaS are maximising user control when managing features related to the privacy of sensitive information, accomplished through user data privacy methods and self-installed configurable software.
• Cloud Software as a Service (SaaS): SaaS provides confinement for client flexibility by providing software applications and APIs for developers such as GoogleMaps and Bloomberg. SaaS consumers are obliged to pay for software on a subscription basis, with no need for prior installations. Accessing SaaS software is primarily through the internet via a web browser. SaaS provides live applications running in the cloud, accessed through users’ devices connected to the internet. Unlike the IaaS, SaaS user does not have control over storage, operating systems, network components, or the underlying infrastructure [ 41 ]. Its primary advantage is its multi-tenancy nature because it can share access control to the software.

2.2. Cloud Computing Deployment Models

• Private cloud: Deployment environment is owned by private sectors solely for the secure storage of company’s data [ 41 ]. Private clouds are managed mainly by third-party providers but exist on-premise. Access is granted only by company staff to control authorisation management for security purposes. For example, an organisation that wants to make its customer’s data available can create a private data centre. Providing more access control over sensitive information and enhanced data security mechanisms to ensure privacy in a private cloud setting. The major drawback of these settings is their purchase cost for equipment and utility bills.
• Community cloud: A cloud environment collectively owned by a set of organisations with the same motive. The community cloud is similar to a private cloud, but the computational resources and underlying infrastructure are exclusively controlled by two organisations with common privacy and security motives. It is also more expensive than the public cloud, and data access is not regulated correctly due to untrusted parties that might arise. The advantage of the community cloud is the involvement of fair third-party access for security auditing.
• Public cloud: The public cloud is mainly owned by large organisations offering cloud services, such as Google Apps, Amazon AWS and Microsoft Office 365. Resources in public clouds are primarily provided as a service at a pass-as-you-go fee. The benefits are mainly on-demand purchases: the more the usage, the more the payment. Public cloud users are mostly home users in their houses accessing the providers’ network via the internet. The security issues of the public cloud are its lack of data security and privacy as a result of its public nature. There is no control over the transmission of information or the access to sensitive data [ 41 ]. Despite its colossal security limitation, small organisations have benefited from its services due to their limited sensitive information with minimal privacy risks.
• Hybrid cloud: A hybrid cloud service can be offered by a private cloud owner forming a partnership with a public owner, making it more complex because of the involvement of two or more cloud providers. This approach allows the cost-effectiveness and scalability of public cloud environments without exposing data to third-party and mission-critical software applications. The hybrid system offers private cloud features, enabling rapid scalability features of the public cloud. Overall, it provides a drastic improvement to organisational agility and offers greater flexibility to business when compared to other approaches. The security limitations of the hybrid cloud are the limitations of the public cloud, such as public exposure of sensitive information, which poses a significant security risk. An approach to solving this issue is the idea of identity and access management to cloud facilities.

3. Cloud Computing Security

• Immoral use and abuse of cloud computing: Cloud computing infrastructure offers various utilities for users, including storage and bandwidth capacities. However, the cloud infrastructure lacks full control over the use of these resources, granting malicious users and attackers the zeal to exploit these weaknesses. Malicious users abuse cloud resources by targeting attack points and launching DDoS, Captcha solving farms and password cracking attacks. These threats mostly affect the PaaS and IaaS layers due to their high user interaction level.
• Malicious insider attackers: Attacks generated from malicious insiders have been one of the most neglected attacks, but it has been the most devastating form of attack affecting all layers of the cloud infrastructure. A malicious insider with high-level access can gain root privilege to network components, tampering with sensitive and confidential data. This attack poses many security threats because Intrusion Detection Systems [ 47 ] and firewalls bypass such anomalous behaviours, assuming it as a legal activity, thereby posing no risk of detection.
• Vulnerable programming interfaces: Part of the cloud services for user interaction in all layers is publishing APIs for easy deployment or the development of software applications. These interfaces provide an extra layer to the cloud framework to increase complexity. Unfortunately, these interfaces bring vulnerabilities in the APIs for malicious users to exploit through backdoor access. These types of vulnerabilities can affect the underlying operations of the cloud architecture.
• Data leakage and loss: One of the significant concerns of cloud computing is data leakage due to the constant migration and transmission of information over untrusted channels [ 10 ]. Loss of data can lead to data theft, which has become the biggest threat to the IT world, costing clients and industries a massive amount of money in losses. Causes of data loss result from weak authentication and encryption schemes, defective data centres, and a lack of disaster control.
• Distributed technology vulnerabilities: The multi-tenant architecture offers virtualisation for shared on-demand services, meaning that one application can be shared among several users, as long as they have access. However, vulnerabilities in the hypervisor allow malicious intruders to gain control over legitimate virtual machines. These vulnerabilities can also affect the underlying operations of the cloud architecture, thereby altering its regular operation.
• Services and account hijacking: This is the ability of a malicious intruder to redirect a web service to an illegitimate website. Malicious intruders then have access to the legitimate site and reused credentials and perform phishing attacks and identity theft.
• Anonymous profile threat: cloud services possess the ability to provide less involvement and maintenance for hardware and software. However, this poses threats to security compliance, hardening, auditing, patching, logging processes and lack of awareness of internal security measures. An anonymous profile threat can expose an organisation to the significant risk of confidential information disclosure.

3.1. User-Centric Cloud Accountability

3.2. digital identity management, 3.3. data integrity, 3.4. cloud intrusion and detection.

• Decision Tree Algorithm: This technique is implemented through the concept of game theory. The DT algorithm is implemented in Intrusion Detection Systems by choosing splitting attributes with the highest information gain using Equation ( 1 ), because the probability of occurrence of an attribute is based on the amount of information that can be associated with the attribute. Let the D and H ( D ) be the data in a given dataset, and C be the associated class, then G a i n ( D , S ) = H ( D ) − ∑ i = 1 S p ( D i ) H ( D i ) (1) Quantifying the information gain of an attribute is achieved through the concept of entropy by measuring the level of randomness in a dataset, as shown in Equation ( 2 ). If the data belongs to a single dataset with no uncertainty, then the entropy is zero, as established in Equation ( 2 ). E n t r o p y : H ( p 1 , p 2 , ⋯ , p s ) = ∑ i = 1 S ( p i [ l o g ( 1 / p i ) ] ) (2) One main advantage of the DT classifier is that it constantly partitions the given dataset into subsets for all elements, where final subsets belong to the same class.
• K-Nearest Neighbour (KNN): The KNN algorithm is based on distance measures between classes. It seeks to find k attributes in the training data, which seem to be closest to the test example [ 68 ]. After which, it assigns the most frequent label among these examples to the new model. Whenever any classification is made, it first calculates its distance to each attribute contained in the dataset and only k closest ones are considered.
• Bayes Rule (BR): BR calculates the probability of a hypothesis based on prior probability, as depicted in Equation ( 3 ). Given an observed dataset D and any form of initial knowledge, the best possible hypothesis will be the most probable one. Given that h = h y p o t h e s i s , P ( h | D ) = p o s t e r i o r p r o b a b i l i t y , p ( h ) = p r i o r p r o b a b i l i t y . In some cases where we are most interested in calculating the most probable hypothesis ( h ϵ H ), this is defined as the Maximum Posterior Hypothesis (MPH), defined in Equation ( 4 ). From Equation ( 4 ), if we assume that the probability of the data P ( D ) is constant because of its dependency on the hypothesis h , then P ( D | h ) is called the Maximum Likelihood (ML) hypothesis, shown in Equation ( 5 ). B R : P ( h | D ) = P ( D | h ) P ( h ) P ( D ) (3) h m p s ≡ a r g m a x h ϵ H P ( h | D ) (4) = a r g m a x h ϵ H P ( h | D ) P ( h ) P ( D ) = a r g m a x h ϵ H P ( D | h ) P ( h ) h m l ≡ a r g m a x h ϵ H P ( D | h ) (5)
• Naive Bayesian (NB): NB is a probabilistic approach very similar to the Bayesian Rule. It computes the probability of each class and then determines which attributes to classify and learn to predict the new class. Given a vector V represented by n different variables V = V 1 , V 2 , V 3 … V n assigned to probability instances P = C k | V 1 , V 2 , V 3 … V n for every k possible results or classes C k , the conditional probability can be formulated, as shown in Equation ( 6 ). P ( C k | V ) = P ( V | C k ) P ( C k ) P ( V ) (6) where P ( C k | V ) = Posterior Probability, P ( V | C k ) = P r i o r P r o b a b i l i t y , P ( C k ) = Likelihood and P ( V ) = Evidence. The joint computation can then be written as follows P ( C k ) = ∏ i = 1 n P ( v i | C k ) (7)
• Support Vector Machines (SVM): SVM is a numerical learning model centred on a data-mining approach. It was initially introduced for only data classification, but with the advance of complex situations, it has now been fully implemented for clustering tasks and regression analysis. There are different notions about the performance level of SVM compared to neural networks. Still, many authors from the literature agree that SVM performs better than the multi-layer perceptron as a result of its reversed neural network design [ 69 ]. The SVM can also be used in spam filtering pattern recognition and anomaly network detection [ 70 ]. Training data usually achieve the near precise SVM classification to classify unidentified samples given training model data. SVM has the advantage of finding an optimum global result by performing linear separation in a hyperplane to two separate classes. After this separation, the closest data to the hyperplane are classified as the correct class. Considering a training dataset D l = x i , y i i = l l , x i = i t h input vector for x i ϵ R n , y i ϵ + 1 , − 1 , where l = total number of input vectors, and n = dimension of the input vector space. Assuming the relationship between x and y be y = S g n f x + ϵ , where S g n x = i if x ≥ 0 and S g n x = i if x < 0 . Then, the task to uncover f is called the Classification Function . SVM evaluates Equation ( 8 ) to create a trade-off between complexity and empirical error of the hypothesis space, where C = the regularisation parameter that will control the identified trade-offs of the used hypothesis space. min f f k 2 + C ∑ i = 1 l 1 − y i f X i (8)

4. Privacy Preserving in Cloud Computing

• S will not be able to learn any rules in R.
• S will be convinced that E ∩ R = φ holds.
• S ′ will only learn the class value of a and what is implied by the class value.
• Privacy-Preserving Additive Splitting Technique: If a value x is assumed as input, then x is said to be additively split between different parties A and B , if A has a random x A and B has a random x B , such that x A + x B = x , where the addition is modular. If y is split in a similar manner ( = y A + y B ) then A and B can compute the sum of x and y by adding their respective shares of x and y , that is, if z = x + y , then A computes z A = x A + y A and B computes z B = x B + y B . Computing z = x * y in split form is considerably complicated if x and y are additively split.
• Privacy-Preserving Encoding Based Splitting Technique: This is the process where only A generates an encoding known to only A , and another party B computes the encoded element but has no meaning to B . In other words, B does not know what the encoding of A means. As an example, let i represent an intermediary Boolean variable. If A generates a random value r i [ 0 ] as the encoding for i , and another randomly generated value r i [ 1 ] for encoding the value 1. As the computation proceeds, B is able to see the encodings r i [ 0 ] or r i [ 1 ] but cannot deduce their meaning.
• Homomorphic Encryption: Using homomorphic encryption, a cryptosystem E is said to be homomorphic in message space M and ciphertext C such that ∀ m 1 , m 2 ϵ M : E ( m 1 ⊙ M m 2 ) = E ( m 1 ) ⊙ c E ( m 2 ) . Where ⊙ M and ⊙ c are the binary operators in p l a i n t e x t : M and C i p h e r t e x t : C . If we denote an encryption function by E p k and a decryption function by D s k , then it is possible to compute E p k ( x + y ) of two inputs x and y that are encrypted as E p k ( x ) and E p k ( y ) by computing E p k ( x ) * E p k ( y ) . Furthermore, with E p k ( x ) , it is possible to compute E p k ( c * x ) for any constant c by computing E p k ( x ) c .

4.1. Data Privacy

4.2. access control.

• Information-Centric Security: Data objects should contain access-control policies. This can be implemented through outsourcing data architectures that integrate cryptographic techniques with access control [ 84 ].
• Trusted Computing: Trusted cloud computing system that provides consistency in accordance with software or hardware specification [ 82 ].
• Cryptographic Protocols: Cryptographic tools and techniques can be employed to achieve privacy, such as Fully Homomorphic Encryption (FHE) [ 85 ] and Attribute-Based Encryption [ 86 ].

4.3. Privacy Preservation through Access Patterns and Design

• Anonymity can be defined as a quality that does not permit the user to be identified in any form, either directly or indirectly. A problem that can arise when a user is anonymous is the issue of Accountability and a large anonymity set. The benefits include location tracking freedom, users freedom of expression and low user involvement. This property can be implemented using Tor [ 92 ], Onion routing [ 93 ] and DC-nets [ 94 ]
• Pseudonymity can be defined as the utilisation of an alias instead of personally identifiable information. A problem that can arise is the issue of Integrity [ 95 ]. The benefits include supporting user access to services without disclosing real identities. Users still maintain integrity protocol. This property can be implemented using administrative tools such as biometrics, identity management and smart cards.
• Unlinkability can be defined as using a service or resource with the inability of third-party linkage between the user and the service. Issue: Integrity and Accountability . Benefits: privacy-preserving by not allowing malicious monitoring of user experience. Implementation: Onion routing, Tor and DC-nets.
• Undetectability inability of third-party tracking amongst a set of possible users. Issues: undetectability strength is highly dependent on the size of the undetectability set. Benefits: preserve users’ privacy without allowing detectability of service by malicious intruders. Secondly, attackers cannot adequately detect the existence of an exact Item of Interest (IOI), e.g., the use of steganography and watermarking. Implementation: smartcards and permission management, encryption methods such as mail and transaction encryption.
• Unobservability inability to perceive the existence of a user amongst a set of potential users. Issue: dependent on the integrity level and anonymity set. Benefits: anonymity and undetectability enforcement per resources. Secondly, ensuring user experience without the connection and observability of a third-party. Implementation: smartcards and permission management. Anonymizer services such as Tor, Hordes and GAP.

5. Final Remarks

5.1. discussion, 5.2. conclusion, author contributions, acknowledgments, conflicts of interest.

• Tari, Z. Security and Privacy in Cloud Computing. IEEE Cloud Comput. 2014 , 1 , 54–57. [ Google Scholar ]
• Bentajer, A.; Hedabou, M.; Abouelmehdi, K.; Elfezazi, S. CS-IBE: A data confidentiality system in public cloud storage system. Procedia Comput. Sci. 2018 , 141 , 559–564. [ Google Scholar ]
• Fernandez-Gago, C.; Pearson, S.; D’errico, M.; Alnemr, R.; Pulls, T.; de Oliveira, A.S. A4Cloud Workshop: Accountability in the Cloud. In Proceedings of the IFIP International Summer School on Privacy and Identity Management, Edinburgh, UK, 16–21 August 2015; pp. 61–78. [ Google Scholar ]
• Azougaghe, A.; Oualhaj, O.A.; Hedabou, M.; Belkasmi, M.; Kobbane, A. Many-to-one matching game towards secure virtual machines migration in cloud computing. In Proceedings of the 2016 International Conference on Advanced Communication Systems and Information Security (ACOSIS), Marrakesh, Morocco, 17–19 October 2016; pp. 1–7. [ Google Scholar ]
• Mollah, M.B.; Azad, M.A.K.; Vasilakos, A. Security and privacy challenges in mobile cloud computing: Survey and way ahead. J. Netw. Comput. Appl. 2017 , 84 , 38–54. [ Google Scholar ]
• Warren, S.D.; Brandeis, L.D. The Right to Privacy Harward Law Review. In Ethical Issues in the Use of Computers ; Wadsworth Publishing Co.: Belmont, CA, USA, 1890; Volume 4, pp. 193–220. [ Google Scholar ]
• Deng, M. Privacy Preserving Content Protection (Privacy Behoud Content Protection) ; Faculty of Engineering—Katholieke Universiteit Leuven: Leuven, Belgium, 2010. [ Google Scholar ]
• Priem, B.; Kosta, E.; Kuczerawy, A.; Dumortier, J.; Leenes, R. User-centric privacy-enhancing identity management. In Digital Privacy ; Springer: New York, NY, USA, 2011; pp. 91–106. [ Google Scholar ]
• Kumar, P.; Sehgal, V.K.; Chauhan, D.S.; Gupta, P.; Diwakar, M. Effective ways of secure, private and trusted cloud computing. arXiv 2011 , arXiv:1111.3165. [ Google Scholar ]
• Abdulsalam, Y.S.; Hedabou, M. Decentralized Data Integrity Scheme for Preserving Privacy in Cloud Computing. In Proceedings of the 2021 International Conference on Security, Pattern Analysis, and Cybernetics (SPAC), Chengdu, China, 18–20 June 2021; pp. 607–612. [ Google Scholar ]
• Sun, X.; Liu, P.; Singhal, A. Toward Cyberresiliency in the Context of Cloud Computing [Resilient Security]. IEEE Secur. Priv. 2018 , 16 , 71–75. [ Google Scholar ]
• Chen, D.; Zhao, H. Data security and privacy protection issues in cloud computing. In Proceedings of the 2012 International Conference on Computer Science and Electronics Engineering, Hangzhou, China, 23–25 March 2012; Volume 1, pp. 647–651. [ Google Scholar ]
• Kohnfelder, L.; Garg, P. The Threats to Our Products ; Microsoft Interface Microsoft Corp.: Albuquerque, NM, USA, 1999; Volume 33. [ Google Scholar ]
• Khan, R.; McLaughlin, K.; Laverty, D.; Sezer, S. STRIDE-based threat modeling for cyber-physical systems. In Proceedings of the 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe), Turin, Italy, 26–29 September 2017; pp. 1–6. [ Google Scholar ]
• James, J.I.; Shosha, A.F.; Gladyhsev, P. Determining Training Needs for Cloud Infrastructure Investigations Using I-STRIDE. In Proceedings of the International Conference on Digital Forensics and Cyber Crime, Moscow, Russia, 26–27 September 2013; pp. 223–236. [ Google Scholar ]
• Tabrizchi, H.; Rafsanjani, M.K. A survey on security challenges in cloud computing: Issues, threats, and solutions. J. Supercomput. 2020 , 76 , 9493–9532. [ Google Scholar ]
• Modi, C.; Patel, D.; Borisaniya, B.; Patel, A.; Rajarajan, M. A survey on security issues and solutions at different layers of Cloud computing. J. Supercomput. 2013 , 63 , 561–592. [ Google Scholar ]
• Sgandurra, D.; Lupu, E. Evolution of attacks, threat models, and solutions for virtualized systems. ACM Comput. Surv. 2016 , 48 , 1–38. [ Google Scholar ]
• Subramanian, N.; Jeyaraj, A. Recent security challenges in cloud computing. Comput. Electr. Eng. 2018 , 71 , 28–42. [ Google Scholar ]
• Subashini, S.; Kavitha, V. A survey on security issues in service delivery models of cloud computing. J. Netw. Comput. Appl. 2011 , 34 , 1–11. [ Google Scholar ]
• Zhan, Z.H.; Liu, X.F.; Gong, Y.J.; Zhang, J.; Chung, H.S.H.; Li, Y. Cloud computing resource scheduling and a survey of its evolutionary approaches. ACM Comput. Surv. 2015 , 47 , 1–33. [ Google Scholar ]
• Basu, S.; Bardhan, A.; Gupta, K.; Saha, P.; Pal, M.; Bose, M.; Basu, K.; Chaudhury, S.; Sarkar, P. Cloud computing security challenges & solutions-A survey. In Proceedings of the 2018 IEEE 8th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA, 8–10 January 2018; pp. 347–356. [ Google Scholar ]
• Li, R.; Xiao, Y.; Zhang, C.; Song, T.; Hu, C. Cryptographic algorithms for privacy-preserving online applications. Math. Found. Comput. 2018 , 1 , 311. [ Google Scholar ]
• Kim, W. Cloud computing: Today and tomorrow. J. Object Technol. 2009 , 8 , 65–72. [ Google Scholar ]
• Hedabou, M. Cryptography for Addressing Cloud Computing Security, Privacy, and Trust Issues. In Computer and Cyber Security ; Auerbach Publications: Boca Raton, FL, USA, 2018; pp. 281–304. [ Google Scholar ]
• Chandramouli, R.; Iorga, M.; Chokhani, S. Cryptographic key management issues and challenges in cloud services. In Secure Cloud Computing ; Springer: New York, NY, USA, 2014; pp. 1–30. [ Google Scholar ]
• Yang, K.; Jia, X. Data storage auditing service in cloud computing: Challenges, methods and opportunities. World Wide Web 2012 , 15 , 409–428. [ Google Scholar ]
• Arunarani, A.; Manjula, D.; Sugumaran, V. Task scheduling techniques in cloud computing: A literature survey. Future Gener. Comput. Syst. 2019 , 91 , 407–415. [ Google Scholar ]
• Xiao, Z.; Xiao, Y. Security and privacy in cloud computing. IEEE Commun. Surv. Tutor. 2012 , 15 , 843–859. [ Google Scholar ]
• Liu, D. Securing outsourced databases in the cloud. In Security, Privacy and Trust in Cloud Systems ; Springer: New York, NY, USA, 2014; pp. 259–282. [ Google Scholar ]
• Sookhak, M.; Talebian, H.; Ahmed, E.; Gani, A.; Khan, M.K. A review on remote data auditing in single cloud server: Taxonomy and open issues. J. Netw. Comput. Appl. 2014 , 43 , 121–141. [ Google Scholar ]
• Pearson, S.; Benameur, A. Privacy, security and trust issues arising from cloud computing. In Proceedings of the 2010 IEEE Second International Conference on Cloud Computing Technology and Science, Indianapolis, IN, USA, 30 November–3 December 2010; pp. 693–702. [ Google Scholar ]
• Wu, H.; Zhao, B. Overview of current techniques in remote data auditing. Appl. Math. Nonlinear Sci. 2016 , 1 , 140–153. [ Google Scholar ]
• Sookhak, M.; Gani, A.; Talebian, H.; Akhunzada, A.; Khan, S.U.; Buyya, R.; Zomaya, A.Y. Remote data auditing in cloud computing environments: A survey, taxonomy, and open issues. ACM Comput. Surv. 2015 , 47 , 1–34. [ Google Scholar ]
• Varghese, B.; Buyya, R. Next generation cloud computing: New trends and research directions. Future Gener. Comput. Syst. 2018 , 79 , 849–861. [ Google Scholar ]
• Cook, A.; Robinson, M.; Ferrag, M.A.; Maglaras, L.A.; He, Y.; Jones, K.; Janicke, H. Internet of cloud: Security and privacy issues. In Cloud Computing for Optimization: Foundations, Applications, and Challenges ; Springer: New York, NY, USA, 2018; pp. 271–301. [ Google Scholar ]
• Tan, Z.; Nagar, U.T.; He, X.; Nanda, P.; Liu, R.P.; Wang, S.; Hu, J. Enhancing big data security with collaborative intrusion detection. IEEE Cloud Comput. 2014 , 1 , 27–33. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Wang, C.; Ren, K.; Yu, S.; Urs, K.M.R. Achieving usable and privacy-assured similarity search over outsourced cloud data. In Proceedings of the 2012 Proceedings IEEE INFOCOM, Orlando, FL, USA, 25–30 March 2012; pp. 451–459. [ Google Scholar ]
• Zhou, M.; Zhang, R.; Xie, W.; Qian, W.; Zhou, A. Security and privacy in cloud computing: A survey. In Proceedings of the 2010 Sixth International Conference on Semantics, Knowledge and Grids, Beijing, China, 1–3 November 2010; pp. 105–112. [ Google Scholar ]
• Zou, J. Accountability in Cloud Services. Ph.D. Thesis, Macquarie University, Sydney, Australia, 2016. [ Google Scholar ]
• Goyal, S. Public vs private vs hybrid vs community-cloud computing: A critical review. Int. J. Comput. Netw. Inf. Secur. 2014 , 6 , 20. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Hedabou, M.; Abdulsalam, Y.S. Efficient and Secure Implementation of BLS Multisignature Scheme on TPM. In Proceedings of the 2020 IEEE International Conference on Intelligence and Security Informatics (ISI), Arlington, VA, USA, 9–10 November 2020; pp. 1–6. [ Google Scholar ]
• Kamara, S.; Moataz, T. Boolean searchable symmetric encryption with worst-case sub-linear complexity. In Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques, Paris, France, 30 April–4 May 2017; pp. 94–124. [ Google Scholar ]
• Li, P.; Li, J.; Huang, Z.; Li, T.; Gao, C.Z.; Yiu, S.M.; Chen, K. Multi-key privacy-preserving deep learning in cloud computing. Future Gener. Comput. Syst. 2017 , 74 , 76–85. [ Google Scholar ] [ CrossRef ]
• Pearson, S. Taking account of privacy when designing cloud computing services. In Proceedings of the 2009 ICSE Workshop on Software Engineering Challenges of Cloud Computing, Vancouver, BC, Canada, 23 May 2009; pp. 44–52. [ Google Scholar ]
• Ko, R.K.; Jagadpramana, P.; Mowbray, M.; Pearson, S.; Kirchberg, M.; Liang, Q.; Lee, B.S. TrustCloud: A framework for accountability and trust in cloud computing. In Proceedings of the 2011 IEEE World Congress on Services, Washington, DC, USA, 4–9 July 2011; pp. 584–588. [ Google Scholar ]
• Patel, A.; Taghavi, M.; Bakhtiyari, K.; JúNior, J.C. An intrusion detection and prevention system in cloud computing: A systematic review. J. Netw. Comput. Appl. 2013 , 36 , 25–41. [ Google Scholar ] [ CrossRef ]
• Li, X.Y.; Zhou, L.T.; Shi, Y.; Guo, Y. A trusted computing environment model in cloud architecture. In Proceedings of the 2010 International Conference on Machine Learning and Cybernetics, Qingdao, China, 11–14 July 2010; Volume 6, pp. 2843–2848. [ Google Scholar ]
• Bertino, E.; Paci, F.; Ferrini, R.; Shang, N. Privacy-preserving digital identity management for cloud computing. IEEE Data Eng. Bull. 2009 , 32 , 21–27. [ Google Scholar ]
• Paci, F.; Shang, N.; Steuer Jr, K.; Fernando, R.; Bertino, E. VeryIDX-A privacy preserving digital identity management system for mobile devices. In Proceedings of the 2009 Tenth International Conference on Mobile Data Management: Systems, Services and Middleware, Taipei, Taiwan, 18–20 May 2009; pp. 367–368. [ Google Scholar ]
• Wu, H.; Zheng, W.; Chiesa, A.; Popa, R.A.; Stoica, I. DIZK: A Distributed Zero Knowledge Proof System. In Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD USA, 12–17 August 2018; pp. 675–692. [ Google Scholar ]
• Hedabou, M. A frobenius map approach for an efficient and secure multiplication on Koblitz curves. Int. J. Netw. Secur. 2006 , 3 , 239–243. [ Google Scholar ]
• Wang, C.; Wang, Q.; Ren, K.; Lou, W. Privacy-preserving public auditing for data storage security in cloud computing. In Proceedings of the 2010 Proceedings IEEE Infocom, San Diego, CA, USA, 14–19 March 2010; pp. 1–9. [ Google Scholar ]
• Fiore, D.; Mitrokotsa, A.; Nizzardo, L.; Pagnin, E. Multi-key homomorphic authenticators. In Proceedings of the International Conference on the Theory and Application of Cryptology and Information Security, Hanoi, Vietnam, 4–8 December 2016; pp. 499–530. [ Google Scholar ]
• Garg, N.; Bawa, S. RITS-MHT: Relative indexed and time stamped Merkle hash tree based data auditing protocol for cloud computing. J. Netw. Comput. Appl. 2017 , 84 , 1–13. [ Google Scholar ] [ CrossRef ]
• Ateniese, G.; Di Pietro, R.; Mancini, L.V.; Tsudik, G. Scalable and efficient provable data possession. In Proceedings of the 4th International Conference on Security and Privacy in Communication Netowrks, Istanbul, Turkey, 22–25 September 2008; pp. 1–10. [ Google Scholar ]
• Erway, C.C.; Küpçü, A.; Papamanthou, C.; Tamassia, R. Dynamic provable data possession. ACM Trans. Inf. Syst. Secur. 2015 , 17 , 1–29. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Curtmola, R.; Khan, O.; Burns, R.; Ateniese, G. MR-PDP: Multiple-replica provable data possession. In Proceedings of the 2008 the 28th International Conference on Distributed Computing Systems, Beijing, China, 17–20 June 2008; pp. 411–420. [ Google Scholar ]
• He, D.; Zeadally, S.; Wu, L. Certificateless public auditing scheme for cloud-assisted wireless body area networks. IEEE Syst. J. 2015 , 12 , 64–73. [ Google Scholar ] [ CrossRef ]
• Kang, B.; Wang, J.; Shao, D. Certificateless public auditing with privacy preserving for cloud-assisted wireless body area networks. Mob. Inf. Syst. 2017 , 2017 , 2925465. [ Google Scholar ] [ CrossRef ]
• Garg, N.; Bawa, S.; Kumar, N. An efficient data integrity auditing protocol for cloud computing. Future Gener. Comput. Syst. 2020 , 109 , 306–316. [ Google Scholar ] [ CrossRef ]
• Sookhak, M.; Yu, F.R.; Zomaya, A.Y. Auditing big data storage in cloud computing using divide and conquer tables. IEEE Trans. Parallel Distrib. Syst. 2017 , 29 , 999–1012. [ Google Scholar ] [ CrossRef ]
• Zhang, Y.; Xu, C.; Lin, X.; Shen, X.S. Blockchain-based public integrity verification for cloud storage against procrastinating auditors. IEEE Trans. Cloud Comput. 2019 , 9 , 923–937. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Eyal, I.; Gencer, A.E.; Sirer, E.G.; Van Renesse, R. Bitcoin-ng: A scalable blockchain protocol. In Proceedings of the 13th USENIX symposium on networked systems design and implementation (NSDI 16), Santa Clara, CA, USA, 16–18 March 2016; pp. 45–59. [ Google Scholar ]
• McConaghy, T.; Marques, R.; Müller, A.; De Jonghe, D.; McConaghy, T.; McMullen, G.; Henderson, R.; Bellemare, S.; Granzotto, A. Bigchaindb: A Scalable Blockchain Database ; White Paper; BigChainDB, Ascribe GmbH: Berlin, Germany, 2016. [ Google Scholar ]
• Gaetani, E.; Aniello, L.; Baldoni, R.; Lombardi, F.; Margheri, A.; Sassone, V. Blockchain-based database to ensure data integrity in cloud computing environments. In Proceedings of the 2020 International Conference on Mainstreaming Block Chain Implementation (ICOMBI), Bengaluru, India, 21–22 February 2017. [ Google Scholar ]
• Sari, A. A review of anomaly detection systems in cloud networks and survey of cloud security measures in cloud storage applications. J. Inf. Secur. 2015 , 6 , 142. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Farid, D.M.; Rahman, M.Z. Anomaly Network Intrusion Detection Based on Improved Self Adaptive Bayesian Algorithm. J. Comput. 2010 , 5 , 23–31. [ Google Scholar ] [ CrossRef ]
• Feizollah, A.; Anuar, N.B.; Salleh, R.; Amalina, F.; Ma’arof, R.R.; Shamshirband, S. A study of machine learning classifiers for anomaly-based mobile botnet detection. Malays. J. Comput. Sci. 2013 , 26 , 251–265. [ Google Scholar ]
• Khorshed, M.T.; Ali, A.S.; Wasimi, S.A. A survey on gaps, threat remediation challenges and some thoughts for proactive attack detection in cloud computing. Future Gener. Comput. Syst. 2012 , 28 , 833–851. [ Google Scholar ] [ CrossRef ]
• Shelke, M.P.K.; Sontakke, M.S.; Gawande, A. Intrusion detection system for cloud computing. Int. J. Sci. Technol. Res. 2012 , 1 , 67–71. [ Google Scholar ]
• Wani, A.R.; Rana, Q.; Saxena, U.; Pandey, N. Analysis and Detection of DDoS Attacks on Cloud Computing Environment using Machine Learning Techniques. In Proceedings of the 2019 Amity International Conference on Artificial Intelligence (AICAI), Dubai, United Arab Emirates, 4–6 February 2019; pp. 870–875. [ Google Scholar ]
• Bhamare, D.; Salman, T.; Samaka, M.; Erbad, A.; Jain, R. Feasibility of supervised machine learning for cloud security. In Proceedings of the 2016 International Conference on Information Science and Security (ICISS), Pattaya, Thailand, 19–22 December 2016; pp. 1–5. [ Google Scholar ]
• Rodriguez, R.A. Method of and Apparatus for Combining Artificial Intelligence (AI) Concepts with Event-Driven Security Architectures and Ideas. U.S. Patent 8,583,574, 12 November 2013. [ Google Scholar ]
• Osanaiye, O.; Cai, H.; Choo, K.K.R.; Dehghantanha, A.; Xu, Z.; Dlodlo, M. Ensemble-based multi-filter feature selection method for DDoS detection in cloud computing. EURASIP J. Wirel. Commun. Netw. 2016 , 2016 , 130. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Gill, S.S.; Buyya, R. SECURE: Self-protection approach in cloud resource management. IEEE Cloud Comput. 2018 , 5 , 60–72. [ Google Scholar ] [ CrossRef ]
• Weyns, D. Software engineering of self-adaptive systems: An organised tour and future challenges. In Chapter in Handbook of Software Engineering ; Linnaeus University: Kalmar, Sweden, 2017. [ Google Scholar ]
• Acquisti, A.; Gritzalis, S.; Lambrinoudakis, C.; di Vimercati, S. Digital Privacy: Theory, Technologies, and Practices ; CRC Press: Boca Raton, FL, USA, 2007. [ Google Scholar ]
• Tyagi, N.; Gilad, Y.; Leung, D.; Zaharia, M.; Zeldovich, N. Stadium: A distributed metadata-private messaging system. In Proceedings of the 26th Symposium on Operating Systems Principles. ACM, Shanghai, China, 28–31 October 2017; pp. 423–440. [ Google Scholar ]
• Goldreich, O.; Ostrovsky, R. Software protection and simulation on oblivious RAMs. J. ACM 1996 , 43 , 431–473. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Goodrich, M.T.; Mitzenmacher, M.; Ohrimenko, O.; Tamassia, R. Privacy-preserving group data access via stateless oblivious RAM simulation. In Proceedings of the Twenty-Third Annual ACM-SIAM Symposium on Discrete Algorithms, Kyoto, Japan, 17–19 January 2012; Society for Industrial and Applied Mathematics: Philadelphia, PA, USA, 2012; pp. 157–167. [ Google Scholar ]
• Stefanov, E.; Van Dijk, M.; Shi, E.; Fletcher, C.; Ren, L.; Yu, X.; Devadas, S. Path ORAM: An extremely simple oblivious RAM protocol. In Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security, Berlin, Germany, 4–8 November 2013; pp. 299–310. [ Google Scholar ]
• Haider, S.K.; van Dijk, M. Flat ORAM: A Simplified Write-Only Oblivious RAM Construction for Secure Processors. Cryptography 2019 , 3 , 10. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Di Vimercati, S.D.C.; Foresti, S.; Jajodia, S.; Paraboschi, S.; Samarati, P. A data outsourcing architecture combining cryptography and access control. In Proceedings of the 2007 ACM Workshop on Computer Security Architecture, Fairfax, VR, USA, 2 November 2007; pp. 63–69. [ Google Scholar ]
• Gentry, C. Fully homomorphic encryption using ideal lattices. In Proceedings of the Forty-First Annual ACM Symposium on Theory of Computing, Bethesda, MD, USA, 31 May–2 June 2009; Volume 9, pp. 169–178. [ Google Scholar ]
• Tang, Y.; Lee, P.P.; Lui, J.C.; Perlman, R. FADE: Secure overlay cloud storage with file assured deletion. In Proceedings of the International Conference on Security and Privacy in Communication Systems, Singapore, 7–9 September 2010; pp. 380–397. [ Google Scholar ]
• Fall, D.; Blanc, G.; Okuda, T.; Kadobayashi, Y.; Yamaguchi, S. Toward quantified risk-adaptive access control for multi-tenant cloud computing. In Proceedings of the 6th Joint Workshop on Information Security, Tokyo, Japan, 8–10 November 2011; pp. 1–14. [ Google Scholar ]
• Yu, E.; Cysneiros, L. Designing for privacy and other competing requirements. In Proceedings of the 2nd Symposium on Requirements Engineering for Information Security (SREIS’02), Raleigh, NC, USA, 16–18 October 2002; pp. 15–16. [ Google Scholar ]
• Kobsa, A.; Schreck, J. Privacy through pseudonymity in user-adaptive systems. ACM Trans. Internet Technol. 2003 , 3 , 149–183. [ Google Scholar ] [ CrossRef ]
• Sgaglione, L.; Coppolino, L.; D’Antonio, S.; Mazzeo, G.; Romano, L.; Cotroneo, D.; Scognamiglio, A. Privacy Preserving Intrusion Detection Via Homomorphic Encryption. In Proceedings of the 2019 IEEE 28th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), Napoli, Italy, 12–14 June 2019; pp. 321–326. [ Google Scholar ]
• Pfitzmann, A.; Hansen, M. A Terminology for Talking about Privacy by Data Minimization: Anonymity, Unlinkability, Undetectability, Unobservability, Pseudonymity, and Identity Management 2010. Available online: http://dud.inf.tu-dresden.de/Anon_Terminology.shtml (accessed on 20 October 2021).
• Dingledine, R.; Mathewson, N.; Syverson, P. Tor: The Second-Generation Onion Router ; Technical Report; Naval Research Lab: Washington, DC, USA, 2004. [ Google Scholar ]
• Goldschlag, D.; Reed, M.; Syverson, P. Onion Routing for Anonymous and Private Internet Connections ; Communication of the ACM; ACM: New York, NY, USA, 1999. [ Google Scholar ]
• Chaum, D. The dining cryptographers problem: Unconditional sender and recipient untraceability. J. Cryptol. 1988 , 1 , 65–75. [ Google Scholar ] [ CrossRef ] [ Green Version ]
• Bagai, R.; Lu, H.; Li, R.; Tang, B. An accurate system-wide anonymity metric for probabilistic attacks. In Proceedings of the International Symposium on Privacy Enhancing Technologies Symposium, Waterloo, ON, Canada, 27–29 July 2011; pp. 117–133. [ Google Scholar ]
• Diamantopoulou, V.; Kalloniatis, C.; Gritzalis, S.; Mouratidis, H. Supporting privacy by design using privacy process patterns. In Proceedings of the IFIP International Conference on ICT Systems Security and Privacy Protection, Rome, Italy, 29–31 May 2017; pp. 491–505. [ Google Scholar ]
• Ngai, E.; Ohlman, B.; Tsudik, G.; Uzun, E.; Wählisch, M.; Wood, C.A. Can we make a cake and eat it too? A discussion of ICN security and privacy. ACM SIGCOMM Comput. Commun. Rev. 2017 , 47 , 49–54. [ Google Scholar ] [ CrossRef ]
• Papanikolaou, N.; Pearson, S.; Mont, M.C. Towards natural-language understanding and automated enforcement of privacy rules and regulations in the cloud: Survey and bibliography. In Proceedings of the FTRA International Conference on Secure and Trust Computing, Data Management, and Application, Loutraki, Greece, 28–30 June 2011; pp. 166–173. [ Google Scholar ]
• Chen, T.; Bahsoon, R.; Yao, X. A survey and taxonomy of self-aware and self-adaptive cloud autoscaling systems. ACM Comput. Surv. 2018 , 51 , 61. [ Google Scholar ] [ CrossRef ] [ Green Version ]

Share and Cite

Abdulsalam, Y.S.; Hedabou, M. Security and Privacy in Cloud Computing: Technical Review. Future Internet 2022 , 14 , 11. https://doi.org/10.3390/fi14010011

Abdulsalam YS, Hedabou M. Security and Privacy in Cloud Computing: Technical Review. Future Internet . 2022; 14(1):11. https://doi.org/10.3390/fi14010011

Abdulsalam, Yunusa Simpa, and Mustapha Hedabou. 2022. "Security and Privacy in Cloud Computing: Technical Review" Future Internet 14, no. 1: 11. https://doi.org/10.3390/fi14010011

Article Metrics

Article access statistics, further information, mdpi initiatives, follow mdpi.

Subscribe to receive issue release notifications and newsletters from MDPI journals

A Review on Security Vulnerabilities in Cloud Computing

• Conference paper
• First Online: 31 August 2024
• Cite this conference paper

• Juvi Bharti 39 &
• Sarpreet Singh 39  

Part of the book series: Lecture Notes in Electrical Engineering ((LNEE,volume 1189))

Included in the following conference series:

• International Conference on Data, Engineering and Applications

Cloud computing is a shared pool of programmable computer system resources and higher-level services that can be instantly delivered through the Internet with minimum administrative work. It offers huge benefits, but it poses numerous security dangers. Before migrating their computing, storage, and applications to the cloud, customers must comprehend upcoming dangers and weaknesses, as well as consider potential responses. Due to the escalating dangers in the cloud environment, the identification of its weaknesses and the most effective instructions for enhancing security have become crucial for all activities conducted there. In this document, for each risk, there is a list of possible countermeasures that are already in place.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save.

• Get 10 units per month
• Download Article/Chapter or eBook
• 1 Unit = 1 Article or 1 Chapter
• Cancel anytime
• Available as PDF
• Read on any device
• Instant download
• Own it forever
• Available as EPUB and PDF
• Durable hardcover edition
• Dispatched in 3 to 5 business days
• Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Grover J, Sharma M et al (2014) Cloud computing and its security issues—A reviews. In: IEEE 5th ICCCNT

Google Scholar  

Zhang Q, Cheng L et al (2010) Cloud computing: state of the art and research challenges. Int J Internet Serv Appl 1(1):7–18

Article   Google Scholar  

Cafaro M, Aloisio G (2010) Grids, clouds and virtualization. Springer, p 7. ISBN 978-1-4471-2592-1

Ma X (2012) Security concerns in cloud computing. In: 4th international conference on computational and information science

Rittinghouse J, Ransom J (2010) Cloud computing: implementation, management and security. CRC Press, Taylor & Francis Group, Boca Raton

Bernsmed et al (2012) Thunder in the clouds: security challenges and solutions for federated clouds. In: 4th IEEE international conference on cloud computing technology and science proceedings

Metheny M (2012) Federal cloud computing : the definitive guide for cloud service providers. Elsevier Science

Chou T-S (2013) Security threats on cloud computing vulnerabilities. Int J Comput Sci Inf Technol 5(3):79–88

Takabi H, Joshi JBD, Ahn G (2010) Security and privacy challenges in cloud computing environments, security & privacy. IEEE 8(6):24–31

Chakraborty R, Ramireddy S, Raghu TS, Rao HR (2010) The information assurance practices of cloud computing vendors. IT Professional 12:29–37

Musa FA, Sani SM (2014) Security threats and countermeasures in cloud computing. Int Res J Electron Comput Eng

Sen J (2018) Security and privacy issues cloud computing. https://pdfs.semanticscholar.org/4dc3/70d253020947a8e66b701e12dd0233161229.pdf . Accessed 11 April 2018

R. Security and privacy in cloud computing. Spring, April 2017

Khormali A, Mohaisen A, Saad M (2018) End-to-End analysis of in-browser cryptojacking

Alhaidary M, Rahman SMM, Gupta BB et al (2018) Vulnerability analysis for the authentication protocols in trusted computing platforms and proposed enhancement of the Off-PAD protocol. IEEE Access 6:6071–6081

Yesilyurt M, Yalman Y (2016) New approach for ensuring cloud computing security: using data hiding methods. Sadhana 41(11):1289–1298

Khalil IM, Khreishah A, Azeem M (2014) Cloud computing security: a survey. Computers 1–35

Ashraf M, Kamel F (2015) Vendor lock-in in the transition to a cloud computing platform. In: Degree project in communication systems second level Stockholm, Sweden, pp 1–42

Dhote C, Potey MM et al (2013) Cloud computing—Understanding risk, threats, vulnerability and controls: a survey. Int J Comput Appl 67:9–14

Jamil D, Zaki H (2011) Security issues in cloud computing and countermeasures. Int J Eng Sci Technol 3(4):2672–2676

Barakat OL et al (2013) Malware analysis performance enhancement using cloud computing,. J Comput Virol Hacking Tech 10(1):1–10

Singh S, Jeong Y-S, Park JH (2016) A survey on cloud computing security: issues, threats, and 86 solutions. J Netw Comput Appl 75:200–222

Rocha F, Abreu S, Correia M (2011) The final frontier: confidentiality and privacy in the cloud. IEEE Comput 44(9):44–50

Pearson S, Yee G (2013) Privacy and security for cloud computing. Springer

Morabito V (2014) Big data in trends and challenges in digital business innovation. Springer Intl. Publishing, pp 3–21

Duncan AJ, Creese S, Goldsmith M (2012) Insider attacks in cloud computing. In: 11th IEEE international conference on trust, security and privacy in computing and communications, TrustCom, pp 857–862

Thampi SM, Zomaya AY, Strufe T, AlcarazCalero JM, Thomas T (2012) Recent trends in computer networks and distributed systems security. In: International conference on security in computer networks and distributed systems, vol 335, Springer

Das SK, Kant K, Zhang N (2012) Handbook on securing cyber-physical critical infrastructure. Morgan Kaufmann

Buyya R, Vecchiola C, Selvi ST (2013) Mastering cloud computing : foundations and applications programming. Morgan Kaufmann

Tang Y, Lee PPC, Lui JCS, Perlman R (2012) Secure overlay cloud storage with access control and assured deletion. IEEE Trans Depend Secur Comput 9(6):903–916

Seddon JJM, Currie WL (2013) Cloud computing and trans-border health data: Unpacking U.S. 95 and EU healthcare regulation and compliance. Health Policy Technol 2(4):pp 229–241

Bansal P, Siddharth S, Agarwal A (2016) Evolution of cloud computing and related security concerns

Alouane M, El Bakkali H (2015) Security, privacy and trust in cloud computing: a comparative study. In: International conference on cloud technologies and applications (CloudTech), pp 1–8

Alani MM (2014) Securing the cloud: threats, attacks and mitigation techniques. J Adv Comput Sci Technol 3(2):202–213

Ardagna CA (2015) From security to assurance in the cloud: a survey 48(50)

Srinivasan S (2014) Security, trust, and regulatory aspects of cloud computing in business environments. IGI-Global

Harfoushi O, Alfawwaz B, Ghatasheh NA, Obiedat R, Abu-Faraj MM, Faris H (2014) Data security issues and challenges in cloud computing: a conceptual analysis and review. Commun Netw 6(1):15–21

Barona R, Anita EAM (2017) A survey on data breach challenges in cloud computing security: Issues and threats. In: International conference on circuit, power and computing technologies

Alhenaki L (2019) A survey on the security of cloud computing. Institute of Electrical and Electronics Engineers

Stallings W (2013) Network security essential: applications and standards. Pearson Education India

Saranya K, Mohanapriya R et al (2014) a review on symmetric key encryption techniques in cryptography. Int J Sci Eng Technol 3(3):539–544

Lal NA, Prasad S, Farik M (2016) A review of authentication methods. Int J Sci Technol Res 5(11)

Chandrasekhar AM, Sahana K, Yashaswini K (2016) Securing cloud environment using firewall and VPN. Int J Adv Res Comput Sci Softw Eng Res 6(1):151–156

Mohammed I, Saleh A, Hamdan HM (2018) On studying the antivirus behavior on Kernel activitie. In: Proceedings of the international conference on frontiers of information technology, April 2018, pp 1–6

Prajapati GI, Surati SB (2017) A review on Ransom ware detection & prevention. Int J Res Sci Innov 4(9):86–91

Anjana, Singh A (2018) Security concerns and countermeasures in cloud computing: a qualitative analysis. Int J Inf Technol

Grabhall K, Jadyal N et al (2016) Data portioning technique to improve cloud data storage security. Int J Adv Res Comput Commun Eng 5

Parisha, Khanna P et al (2017) Hash function based data portioning in cloud computing for secured cloud storage. Int J Eng Res Appl 7(7):1–6

Ouedrogo et al (2015) Security transparency: the next frontier for security research in the cloud. J Cloud Comput: Adv Syst Appl 4(12)

Hashizume et al (2013) An analysis of security issues for cloud computing. J Internet Serv Appl 4(5)

Noura NH, Chenab A et al (2021) Robotics cyber security: vulnerabilities, attacks, countermeasures and recommendations. Int J Inf Secur 115–158

Masud M, Najmi YK et al (2021) A survey on security threats and countermeasures in IoT to achive users confidentiality and realibility

Humayun M, Niazi NZ et al (2020) Cyber security threats and vulnerabilities: a systematic mapping study. Arab J Sci Eng

Janrga A, Singh N (2017) Challenges and prosperity research in cloud computing. Int J Comput Trends Technol 49:200–205

Axon (2018) An introductory paper to the main issues and potential areas for government action Cloud Computing for the Public Sector and its Policy Implications. April

Dar AR, Ravindran D (2018) A comprehensive study on cloud computing paradigm. Int J Adv Res Sci Eng 7(4):235–242

Download references

Author information

Authors and affiliations.

Department of Computer Science, Sri Guru Granth Sahib World University, Punjab, India

Juvi Bharti & Sarpreet Singh

You can also search for this author in PubMed   Google Scholar

Corresponding author

Correspondence to Sarpreet Singh .

Editor information

Editors and affiliations.

Rajiv Gandhi Technical University, Bhopal, Madhya Pradesh, India

Jitendra Agrawal

Oriental Institute of Science and Technology, Bhopal, Madhya Pradesh, India

Rajesh K. Shukla

Sanjeev Sharma

National Kaohsiung University of Science and Technology, Kaohsiung, Taiwan

Chin-Shiuh Shieh

Rights and permissions

Reprints and permissions

Copyright information

© 2024 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.

About this paper

Cite this paper.

Bharti, J., Singh, S. (2024). A Review on Security Vulnerabilities in Cloud Computing. In: Agrawal, J., Shukla, R.K., Sharma, S., Shieh, CS. (eds) Data Engineering and Applications. IDEA 2022. Lecture Notes in Electrical Engineering, vol 1189. Springer, Singapore. https://doi.org/10.1007/978-981-97-2451-2_16

Download citation

DOI : https://doi.org/10.1007/978-981-97-2451-2_16

Published : 31 August 2024

Publisher Name : Springer, Singapore

Print ISBN : 978-981-97-2450-5

Online ISBN : 978-981-97-2451-2

eBook Packages : Intelligent Technologies and Robotics Intelligent Technologies and Robotics (R0)

Share this paper

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Publish with us

Policies and ethics

• Find a journal
• Track your research

This week: the arXiv Accessibility Forum

Help | Advanced Search

Computer Science > Cryptography and Security

Title: data security and privacy in cloud computing: concepts and emerging trends.

Abstract: Millions of users across the world leverages data processing and sharing benefits from cloud environment. Data security and privacy are inevitable requirement of cloud environment. Massive usage and sharing of data among users opens door to security loopholes. This paper envisages a discussion of cloud environment, its utilities, challenges, and emerging research trends confined to secure processing and sharing of data.

Submission history

Access paper:.

• Other Formats

References & Citations

• Google Scholar
• Semantic Scholar

DBLP - CS Bibliography

Bibtex formatted citation.

Bibliographic and Citation Tools

Code, data and media associated with this article, recommenders and search tools.

• Institution

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs .

Cloud Security: An Overview and Current Trend

International Journal of Applied Engineering and Management Letters (IJAEML), 3(2), 53-58. ISSN: 2581-7000, 2019.

6 Pages Posted: 19 Dec 2019 Last revised: 19 May 2020

Prantosh Paul

Raiganj University

P. S. Aithal

Poornaprajna College

Date Written: October 30, 2019

Cloud security is also called as cloud computing security. It is the set of policies, technologies, applications, and control utilized for virtual infrastructure which includes hardware, software, and application. The field is closely related to database security, web security, network security, etc. In other words, cloud security is very close to computer security, IT security or information security. Day by day the IT infrastructure becomes a common need of every individual and organization so the security aspect is an important concern in this regard. Cloud computing security is controlled by different mechanisms such as deterrent control, preventive control, detective control, and collective control. Cloud Vulnerability and Penetrating Testing are very much important for secure and healthy cloud security practices. Cloud Computing is an important name in the IT and Computing domain and this is rising in different organizations and institutions. In this paper different areas of Cloud Computing have been described. There are different models and architecture for cloud computing security and different rules, regulation, and framework. This paper is conceptual in nature and talks about various areas of security in the basic sense. Paper also talks about Security affairs related to the Cloud.

Keywords: Cloud Computing, IT Security, Virtualization, Cloud Security, Mobile Security, Current IT Trends

Suggested Citation: Suggested Citation

Raiganj University ( email )

Yogesh Bhawan; S/O Santi Ranjan Biswas; Ashok Pall Near Asha Cinema Hall; P.O.+ P.S. Raiganj Raiganj, West Bengal 733134 India

P. S. Aithal (Contact Author)

Poornaprajna college ( email ).

Poornaprajna Institute of Management Udupi District Karnataka India +919343348392 (Phone)

HOME PAGE: http://www.pim.ac.in

Do you have a job opening that you would like to promote on SSRN?

Paper statistics, related ejournals, cybersecurity, privacy, & networks ejournal.

Subscribe to this fee journal for more curated articles on this topic

Electrical Engineering eJournal

IEEE Account

• Change Username/Password
• Update Address

Purchase Details

• Payment Options
• Order History
• View Purchased Documents

Profile Information

• Communications Preferences
• Profession and Education
• Technical Interests
• US & Canada: +1 800 678 4333
• Worldwide: +1 732 981 0060
• Contact & Support
• About IEEE Xplore
• Accessibility
• Terms of Use
• Nondiscrimination Policy
• Privacy & Opting Out of Cookies

A not-for-profit organization, IEEE is the world's largest technical professional organization dedicated to advancing technology for the benefit of humanity. © Copyright 2024 IEEE - All rights reserved. Use of this web site signifies your agreement to the terms and conditions.